Indirect Prompt Injection: What NVIDIA's NXDirection Fix Means

On October 14, NVIDIA researchers published NXDirection, a defense against indirect prompt injection that works inside the model instead of in the prompt. On the BIPIA benchmark it cut attack success from 38.1% to 0.1%, while clean task utility dropped only two points, from 78.4% to 76.4% (AI Weekly).

If your AI reads emails, PDFs, support tickets or web pages and can also take actions, this is the attack to plan for. Here's what NVIDIA did, where it falls short, and what to change in your own systems this quarter.

TL;DR#

• NXDirection treats text from outside sources as data, not instructions, by removing an "instruction direction" from those tokens inside the model.
• It only works on open-weight or self-hosted models (it tested Llama, Qwen and Gemma), so teams on closed APIs can't use it today.
• No single control stops prompt injection attacks. Pair model-level defenses with tight tool permissions and human approval on risky actions.

What indirect prompt injection is, and what NVIDIA changed#

Direct prompt injection is a user typing "ignore your instructions." Indirect prompt injection is sneakier: the attacker never talks to your AI. They plant instructions in content your AI will read later, like a supplier invoice, a product review or a GitHub issue. When your agent processes it, the model can't reliably tell your instructions from theirs.

NVIDIA's write-up frames this as the model mixing up control flow and data flow, and points to the "lethal trifecta": untrusted content, access to private data, and a way to send data out. Any agent with all three can be tricked into leaking.

The NX bit idea#

The name borrows from the operating system's No-eXecute bit, which marks memory as data that must never run as code. NXDirection does something similar for tokens:

1. Researchers built a small corpus of 175 examples across 18 instruction categories.
2. They measured the average activation difference between instruction tokens and plain content tokens at each layer. That difference is the "instruction direction."
3. At inference time, the agent framework flags which tokens came from outside sources. For those tokens only, the instruction component is subtracted.

Your system prompt and the user's request pass through untouched. The extra compute is one dot product and one subtraction per external token per layer, so it's cheap.

Why this result matters#

Prompt injection still sits at number one on the OWASP Top 10 for LLM Applications (Tenable). Most defenses so far have been one of two kinds, and both have real costs.

Prompt tricks like Spotlighting (wrapping external text in delimiters) are cheap but leaky: about 20% attack success remained on BIPIA. Classifier filters like DeBERTa and Prompt Guard 2 catch textbook attacks, but they barely moved the needle on BIPIA, because many injections look like normal, polite task instructions.

The strongest competitor, PromptArmor, got AgentDojo attack success down to 0.2%, slightly better than NXDirection. The catch is an extra LLM call on every piece of external data. If your agent reads 40 emails per run, that's 40 more model calls you pay for and wait on.

NXDirection is the only approach that lands near the ideal corner on both benchmarks: low attack success, high utility and almost no added cost.

The trade-offs nobody should skip#

Here's how the main options compare, using NVIDIA's reported numbers:

What the headline number hides#

The AgentDojo average of 3.7% hides a range. Some models still hit 13.1% attack success on specific multi-turn tasks. NVIDIA calls it "a promising defense, not a guarantee," and that's the right way to read it.

The bigger limit is access. NXDirection needs the model's hidden states, so it only runs where you control the weights. If your stack calls a hosted API, you can't apply it. NVIDIA also hasn't announced a code release yet, and the instruction direction comes from a fairly small corpus.

What it means for your business#

Most scaling companies are wiring AI into the places where untrusted text lives: inboxes, helpdesks, order notes, vendor portals. That's exactly the surface for prompt injection attacks.

• Your model choice is now a security choice. If you run open-weight models in-house, defenses like this will likely become available to you before they reach closed APIs. If you're on a hosted API, you depend on the vendor's own defenses.
• Provenance tracking is the real lesson. NXDirection only works because the agent framework knows which tokens came from outside. Most homegrown agents just concatenate everything into one big prompt. Tagging the source of every chunk of text is useful today, whatever model you use.
• Permissions still do the heavy lifting. A defense that blocks most attacks still misses some. What decides the damage is what the agent is allowed to do when it fails.

Here's a simple way to picture where each control sits:

email / PDF / web page
        |
  [tag as EXTERNAL]  <- provenance
        |
  [model + model-level defense]
        |
  [tool gateway: allowlist, scopes]
        |
  [human approval for money, data export, deletes]
        |
  action + decision log

How to prevent prompt injection: a checklist#

You don't need to wait for NVIDIA to ship code. Here's what to do now:

1. Map the lethal trifecta. List every AI workflow that reads outside content, touches private data and can send anything out (email, webhooks, file uploads). Those are your priority.
2. Break one leg of the trifecta. If an agent reads untrusted email, maybe it doesn't need outbound email at all. Removing a capability beats any filter.
3. Tag provenance in your prompts. Keep system instructions, user requests and external content in separate, labelled blocks. Store the labels so you can add model-level defenses later.
4. Scope tools narrowly. Give each agent read-only access by default, and per-task credentials, not a shared admin key.
5. Put a human gate on high-risk actions. Refunds, payouts, data exports and deletions get an approval step.
6. Log every decision. Record the inputs, the tool calls and who approved what, so you can trace an incident in minutes.
7. Red-team with your own content. Plant a test instruction in a sample invoice or ticket and see what your agent does with it.

How MagicMakers Lab approaches this#

When we build agents for clients, we treat every external document as untrusted from day one: separate provenance blocks, scoped tools through an MCP layer, approval gates on anything that moves money or data, and a decision log for every run. That's how our Agentic Development work is set up, and it's the same discipline behind automations like Framico, where 200+ orders a day ship with zero manual steps.

Key takeaways#

• Indirect prompt injection hides instructions in content your AI reads, not in what users type.
• NXDirection cut BIPIA attack success from 38.1% to 0.1% with about a two-point utility cost.
• It only works on self-hosted, open-weight models, and some tasks still reached 13.1% attack success.
• Tracking where every piece of text came from is the habit to build now.
• Tool scopes, human approval and decision logs limit the damage when a defense misses.

FAQ#

What is indirect prompt injection?#

Indirect prompt injection is an attack where someone hides instructions inside content an AI system will process later, such as an email, PDF, web page or tool result. The attacker never talks to the AI directly. When the model reads that content, it may follow the hidden instructions instead of yours, which can lead to data leaks or unwanted actions.

How is indirect prompt injection different from a jailbreak?#

A jailbreak is a user trying to talk the model out of its rules in their own messages. Indirect prompt injection comes from third-party content the AI reads while doing a task, so the user may be completely innocent. That makes it harder to spot, because the attack arrives through data you trusted enough to feed into the system.

How do you prevent prompt injection attacks?#

No single fix works. Combine several layers: separate trusted instructions from external content, give agents only the tools and permissions each task needs, require human approval for risky actions, log every decision, and test with planted instructions. If you self-host open models, model-level defenses like NXDirection may add another strong layer.

Can I use NXDirection with ChatGPT or Claude?#

Not today. NXDirection needs access to the model's internal activations, which closed commercial APIs don't expose. NVIDIA tested it on open-weight Llama, Qwen and Gemma models. Teams using hosted APIs should rely on provenance tagging, tight tool scopes and approval gates, plus whatever defenses their model vendor provides.

If your team is connecting AI to inboxes, helpdesks or order systems and you're not sure which workflows are exposed, we'll map them with you and show where the risk actually sits. Book a free audit.

Sources#

• NXDirection: No-eXecute Along the Instruction Direction (NVIDIA Research)
• NVIDIA NXDirection drops prompt-injection attack rate to 0.1% (AI Weekly)
• Cybersecurity Snapshot: Prompt Injection and Data Disclosure Top OWASP's List of Cyber Risks for GenAI LLM Apps (Tenable)